# Analyzing a simple encryption scheme using GitHub SSH keys

DevFeed: [Analyzing a simple encryption scheme using GitHub SSH keys](<https://devfeed.tech/articles/analyzing-a-simple-encryption-scheme-using-github-ssh-keys-29170.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2018/09/30/analyzing-github-ssh-key-encryption/>)

Published: 2018-09-30T17:54:00Z

Content type: opinion

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [Encryption](<https://devfeed.tech/topics/encryption.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [openssl](<https://devfeed.tech/topics/openssl.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [SSL](<https://devfeed.tech/topics/ssl.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [channel](<https://devfeed.tech/tags/channel.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [github](<https://devfeed.tech/tags/github.md>), [openssl](<https://devfeed.tech/tags/openssl.md>), [padding](<https://devfeed.tech/tags/padding.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [rsa](<https://devfeed.tech/tags/rsa.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [ssl](<https://devfeed.tech/tags/ssl.md>)

## AI overview

This introductory analysis examines encrypting secrets for recipients using their GitHub SSH public keys and an OpenSSL RSA command. It explains that the scheme's PKCS#1 v1.5 and SSLv2 padding variants are vulnerable to Bleichenbacher's oracle attack, while noting that the described offline threat model does not provide access to a decryption oracle.

## Source excerpt

(This is an introductory level analysis of a scheme involving RSA. If you're already comfortable with Bleichenbacher oracles you should skip it.) Someone pointed me at the following suggestion on the Internet for encrypting secrets to people based on their GitHub SSH keys. I like the idea of making it easier for people to leverage key material and tools they already have. The encryption instructions are: echo "my secret" > message.txt curl -q "https://github.com/${USER}.keys" \ | head -n 1 \ > recipient.pub ssh-keygen -e -m pkcs8 -f recipient.pub > recipient.pem openssl rsautl \ -encrypt \ -pubin \ -inkey recipient.pem \ -ssl \ -in message.txt \ -out encrypted.txt Anything using an openssl command line tool makes me a little uncomfortable. Let's poke at it a little.